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occurred . 

which have been temporarily storar , . Pa " 1Cui « <«* =«e 
servers. d ln 3 Cach = « ™ proxy 

A cache is used to temporarily store hypertext Hie 
to mrnrmrze nonaction ti» to a web server . 
WWW transaction, the client typrcal 
one client computer connects to 



computer connects tn -. 
computer an, quests certain intormation stor^ „ 

:r ™ - -^^=:i t L::te jr- 

conneots trom the server. The customer ^ 

i n iiZ uter may ^ — - his or 

A similar problem occurs with proxy servers a 
company may want to i solate their ««• J 

external computers and networks tor seen,"" 
^ ~ the action ot the companT^™ " 

computers outside th P connections to 

° as a Proxy server. m turn 
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can be visited any „ umber Qf times fay ^ ^ 
client computers without the server's knowledge 
Conventional metering sohe.es are incapable of metering 
these visits, except thr ou g h extracting an estimated 
amount trom metered visits. The number of proxy visits 
however, oan aocount tor a signrficant peroentage of the 
overall number of visit ^ t-n t-K^ 

1S1LS t0 the CQntent from a particular 

web site. 



Metering visits to websites is also necessary for 
commercial applioations other than advertising rot 
example, customers may ohoose to connect to the WWW 
through an Internet Service Provrder ,ISP, . ISPs 
typically charge their customers for connections to the 
WWW by the hour. An Isp may enhance service to customers 
by having sttes referred to as partners that provide 
information on the WWW and assume the charges of clients 
connections to such sites. This would be similar to 
companies which assume the phone charges of calls to » 8 00 
numbers" in the United states. A secure metering scheme 
would enable ISPs to accurately record the number and 
duration of client visits that pass through the ISP to 
the partner site, and use this record to reverse-charge 
the partner site. 

Another example of the need for a secure metering 
scheme can be illustrated with respect to copyrighted 
materia! stored on the Internet. Some web sites post 
copyrighted material, such as art worx or music excerpts 
and are therefore required to pay royalties to the 
copyright owner, s, . A secure metering scheme would 
prevent copyright owners from fraudulently i„f lating 
visits to the web site in an attempt to increase their 
own royalty payments. 
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Dat[i „. u ntormation or content from a 
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The invention uses ^ m=n- 
upon the difficulty n Pr ° t0C01 ^ ^ 

—age audita t " ^ <° 

timing scheme which regu / aT"" 9 Pr ° t0CO1 ^ * 
computation power that a„ b ^""^ ° f * 

can be estimated to within some 
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known accuracy. Since rhe ti ming scheme requires 
lmeSt ' eK ° f -P""ional resources „ hich q grow 
proportionally t o the scale of forgery, the metering 
protocol ma k es the forging 0( vlsit ™ 

' d h mCUU - ThUS ' mass f ""d through the use or robots or 
other means is prevented. 

The invention courses a compact metering scheme 
tor meterrng a visit to a web site . The invention 
prey module lor intercept^ traHic betwee „ . ™ ' 

- — :: :r 

each vrsrt us lng a rr m i„g functio „ p an[J , 

generated for each visit. The metering module returns an 

audrtahle result when the client ends the visit g 

The invention does not reguire re g istratio„ by www 

customers access the WWW. An v rH=nh 

Any cJ -ient running a JAVA- 
enabled www browser automatical!, participates i n he 
metering scheme used in the invention 

The invention records every client visit, whether 
e user obtains the content from the ori g ina ue or 
from any intermediary cache nr ^ 

y cacne or proxy server. Thus rhrr. 

websiL^LT? reqUirSS "° Chan9e « Oration of 
websrte pages. A transparent metering module placed on 

;ir p — - — - - 
»^;e h ;:~:r:: c rrr.rr— - 

cxient and server sides. 
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The invention does not require registration by a 
clrent. Thus, the invention maintains ciient privaoy 

Wrth these and other advantages and features of the 
invention that win become herainafter ^ 
nature of the invention may be more oiearly undersrood by 
reference to the foiling detailed description of the 
invention, the appended claims and to the several 
drawings attached herein. 

BRI EF DESCRIPTION OF TUP- nsju^jj^ 

FIG. 1 is a diagram of the Internet. 

FIG. 2 is a message flow diagram of a typica> HTTP 
protocol used in accordance with an embodrment of the 
invention. ~ " 

FIG. 3 is a message flow diagram of a metering 
protocol used in accordance with an embodiment of the 
invention. 

FIG. A is a block flow diagram of a typical JAVA 
applet used in accordance with an embodiment of the 
invention. 

FIG. 5 is a block system diagram of the WWW using a 
Proxy or intermediary cache to temporarily store 
information from a web server. 

FIG. 6 is a block S y 5t em diagram using a client 
P.oxy module in accordance with an embodiment of the 
invention. 

FIG. 7 i5 a block system diagram using an ISP in 
accordance with an embodiment of the invention. 

DETAILED DESCRIPTION 

The mvention uses a timing scheme which reguires an 
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The purpose 0 f th 

»• "Sit, i^, the ; et 7 r9 = S "5 the duration 
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When signalisd d ' »«P« B5 F during its 
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Whe n a client c i n 
signals p to atop> Jf an end-visit event , it 

3 ignal by t erminating 1S th Sti11 ~ g , p respQnds 

— th. comPUted r 6s ;:;: c :~-o fFand 

t0 ^ ^ computed 
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reSUlt is -aiuated. or aud " . 

scheme described ln detau J*' u«„g the auditlng 

^Hditin 2 _3ch a5 e 

Assume that <F, M> is 
«=°rd has the f orm rec _ ' Y ~ tlm ^ scheme. A visit 

T ° int ™ « coUecUon or £ *' * ' ^ ■ 

»=». the auditor computes ™* »« 

oannot gain mre Large-scale fraud 

-«—s in c 0mPUtln v;;::: ofYbeyond the 

The number of visit ro 

couid - by stor ing :;; ; h tored « * — .it. 

satisfy some predicate ^ose records which 

5 "Stable soccess rate' S^^' Sh ° Uld h ™ - 
individual inputs ' p be h "° to predict for 

-d g , „. The'loditt:^; J 3 trUS if — only if 
stored ti. ing rscorda "9 scheme verities that an 

t^ timing interpretation accord " P » ds 
^ multiply by q t „ p a ;7 d "» '0 the 5ucceas rate 

F IG. 3 i s a m essacTe fi n „ ^- 
P^ocol USed ln a ccoJ anc h la ^ - ^ - ering 
invention. FIG . 3 shows _ an e ^ment of the 

»™» — r 3.. w ; b - -™ to server 24 

he first bein * p~y -a*. 4o L t T riSes tw ° 

k ^Pxng module ^ 40 *nd the 5econd being ^ 

As shown in FIG 3 cl - 
r^uest to server 24 which ^ ^ i£SU£S * TCP/IP 
at st ^P U. Webster 38 a " Webmeter 38 

connection to server 2, a , * f ° r a ^P/ IP 

at Ste P 46. once the T CP/ IP 
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connection i s e5ta bl ■ k 
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fcrgery. ««« ls authentic and not a 

it is worthy of note 
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Placed anywhere else on the c ""^ ^ «». 
-"ant 20 and server 2* C ~«tio„ path bet „ een 
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The invention uses the dif£icul . 
timing scheme to leverege the computing the 

^ in , olvi n 9 ei \ n rr; rity of the m ^ 

'-action r using a unique ^ ;™P«i„ g . tining 
* the computation .J wi ^ Md the result 

*» invention measures LZZrT^ " 1Sit ' 
causing the cliMt thS bv 

-~ i d t :::: r tion F 

returning the output when the , • VlSlt ' " d 

'0 visit event. S in e tl ■ ^ M M 

calculations the client I h °" ^ 

incremental calculation ''7"°"" f « ««* 

J captured. ' ° f the visit i a 

Thus, to forge client visits requires a „ 
xnv.st.ent of computational resources "hL 

computes tiding function p S "« =U.nt 

' — of calculations and k ± tr «» 

incremental calculation win rh 
This ensures that the ca 1 a t 

reproduced. This is D ' CUlatl °" ""put cannot be 

— of visits 5 ::: i r:: iToVr r n the ia - 

Prr , . y j:ound on the WWW. 

invention. , Sh ,„ " ' ^ * 
"titten as a mva applet , a Coring program 

«.P SB. The JAVS "p t L a : * ^ """" " 

-p-.the JSW appL tr :: e ;: rr;: a :: scep 6e - flt 

begins counting an incremental c ^ and 

using the unigue seed aa ,< PaCt " mine s = h ^ F 

assrgned by the proxy module 4 0 of 
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webmeter 38 to this particular visit. At step 70 the 
JAVA applet stops the tiding function F in response to an 
end visit event or when it meets a predetermined upper 
boundry. The JAVA applet sends an auditable result to 
log keeper module 42 when the timing function is stopped 
The JAVA applet is destroyed at step 72. 



SolvinQ The Proxy Proble 
FIG. 



is a block system diagram of the WWW using a 
proxy or intermediary cache to temporarily store 
information from a web server. FIG. 5 shows client 20 
connected to server 24 through Internet 22. P ro >:y server 
74 resides between Internet 22 and client 20 and stores 
information from server 24 requested by client 20. 

FIG. 6 is a block system diagram using a client 
proxy module in accordance with an embodiment of the 
invention. FIG. 6 shows a client proxy module 74 in 
communication with web server 24 through webmeter 38 
The steps shown in FIG. 6 are similar to those shown in 
FIG. 3. The difference in FIG . 6, however, i 3 that all 
communications between a client and a server not only 
pass through webmeter 38, but also through client oroxy 
module 74. When a client such as client 86 requests 

information from server 24 it- Hn D c 4-l. 

it does so through client 
proxy module 74 at step 76. Client proxy module 74 
checks to see if the information requested by client 86 
is cached at client proxy module 74. If noC , client 
proxy module 74 requests the information from server 24 
using steps 44, 46, 48, 50, 52, 54, 56, 58, 60 and 62 
which are the same as those discussed with reference to 



FIG 



If the information is cached at client pro 



i xy 
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module 74, client proxy module 74 does not i ► 
server 24, but nrho, • interact with 

inf Provrdes a cached copy of the 

information to client- ur ■ 

— Mith re ;;i: : t» 3« P 58 

^et attached to the Mched - f - ma - : 



when 



origan source address i e " COntai ^ the 

_ n _ ' i^-' the webmeter's address 

client 86 is finished with th,* i f 

. . ^. , tn the ^formation, the resnif ~f 

the timing computation ^ result of 

y uuipucation returns to wehmeter m at * 
despite client flfi „„- u-.-_ - 38 3t Ste P 64 ' 



«sp lMcll8ntl6 „ 0tbeing . ntoiredi 

81 occurs for any client (e „ , • P 

shown at a 6, 87 and 88 ' thr ° U9h C " ent » 

and 88) requesting cached content f,„ 
client proxy module 74. content from 

"<=■ 7 is a bloc, system diagram us±ng ^ ^ 



FIG. 



accordance with an embodiment of the indention 
shows client 20 connected to web server 2. througt 
Internet 22. isp cm h c i trough 
client 20. , I " S . l0CaM b "»- Fernet 22 and 



client 20. A meter in internet 22 

A meter in accordance with the present 
invention can be placed at ISP 90 . since ZT t . 
charge their customers for , typically 

» >. ^ enhince r the www by the 

Partner sites that provide 1 " I "* 
- c-tges of clten P ts ^^r^jr ~ 
would be similar + n r. sites. This 

cnarges of 1 " hi< * ™ «,e P-one 

BV Placing the Iter "sTT ^ "^^ 
automatically secure, ! CaPabU ° £ 

-sits made » d ™tely metering all 

Timing Scheme 

The invention uses a Mn,i„ 

a tlming 5cheme wh . ch requ . res ^ 
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investment of a client's computation power that can be 
estimated to within some known accuracy. The invention 
uses this estimation to auditably measure the duration of 
a visit. A timing scheme used in one embodiment of the 
invention will now be described in more detail herein. 

An appropriate timing scheme for use with an 
embodiment of the invention has the following properties: 
(1) incremental; (2) compact; (3} accurate; and (4) 
uncheatable. Incremental means that the timing scheme 
can be computed with increasingly large efforts invested. 

Compact means the output of the timing scheme need not 
grow with the amount of effort spent. Accurate means the 
effort spent can be estimated closely from the output. 
Uncheatable means there exists no method for producing 
the output of the timing scheme with considerably less 
effort than the timing scheme itself. 

The timing scheme consists of two components. The 
first is a timing process, which is an incremental 
computation performed by a client. The result is sent 
back to the server. The second is an auditing function 
that estimates the computation time spent producing the 
logged result. Computation time is expressed in terms of 
some agreed upon unit of computation, whose complexity is 
well-analyzed . 

Two sources of imprecision may cause the auditing 
function to deviate from the actual computation time 
spent. The first is the inherent inaccuracy of the 
auditing function, on average, with respect to the real 
effort spent in the timing process. The second is the 
extent to which another "cheater" process may improve the 
average time spent to compute the results. The 
appropriateness of the timing scheme for use with the 
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metering scheme is the overall precision of the estimate 

It is worthy to note that there may exist several 
auditing functions for any particular timing process 
typically trading efficiency with precision. 
5 The basis for a timing process is a grain of 

computation, denoted hf that has the following two 
properties: 

1. The computation complexity of h is well 
10 understood, i.e., a known amount of computation is 

required for computing „, and no other means are known 
today to compute values of h with less computing 
investment , 

I ' 2. Grain h is a cryptographically ideal hash 

function, i^, given y§ it is infeasible tQ determine an 
* such that htxj-y. Furthermore, the values h takes are 
uniformly distributed, such that any outcome in the range 
of values of h is equally likely to occur. 

20 

The idea of a timing process is to employ an 
increasing number of computations of h as the process 
goes on, and when it stops, produce a fixed length 
result. Since the outcome of h is unpredictable 

2, performing * evaluates of b is equivalent to drawing * 
numbers at random from the space of possrble values of h 

To reduce these numbers to a fixed-length result, we 
choose the 1 smallest values thus obtained as the result 
of the computation (where 1 is fixed for any timing 

30 scheme,. Intuitively, the more values of h are computed 
the smaller we expect the final 1 minimum values to be 
This intuition is turned into a precise prediction below 
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Moreover, given a set i of minimal values resulting 
from an unknown number of h computations, there is a 
likely number of k that is the best estimate of the 
effort spent {in terms of the number of h computations). 

This estimator can, on average, estimate the real effort 
spent to a well known accuracy. m this way, an auditor 
may look at the results of the computation of timing 
processes and estimate, to a known accuracy, the time 
spent in them. We note that while an estimate may vary 
considerably from the correct number of h computations in 
any particular incident, it will be reasonably accurate 
over the long run, where many such computations are 
performed. 

A formal definition for a timing scheme and the 
details for one family of constructions used with an 
advantageous embodiment of the invention is provided as 
follows . 

Assume h is a cryptographically ideal hash function, 
i^, like a random oracle. The timing scheme will be 
measuring time in terms of the number of computations of 
h that are performed, so the computational complexity of 
h should be well understood. Assume that a 
(probabilistic) function £ is built from h so that the 
bulk of the work in evaluating f is devoted to evaluating 
h. Let such a function be called an «7i-f unction . " Let 
Uf) denote the expected number of evaluations of h in 
the valuation of f U ) , where the expectation is over the 
coin flips of f and the choice of x from the domain of f. 

Let {f k } be a family of h-f unctions, f k : D k - R k , 
from domain D k to range R k , 3U ch that #(f fc) = km Let ' p . 
(U k R k ) - Q+ be a function from the range spaces of [f y] to 
the positive ratxonals. Intuitively, p i 5 to serve as an 
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auditing function that attempts to estimate the number of 
evaluations of h that were needed to compute some f, {x) 
i^, to estimate * from the result of f k{x) , A " cheater „ 
is an h-function g that, on empty input, outputs some 
number of parrs Uj , yi) SUch that all Qf ^ ^ ^ 
distinct, and such that each Yl _ f ki (x ± ) . 

The timing scheme F = <|f,] (P > is considered » Q - 
accurate" if Q * , E [p{y) : y . ft(x)] ( k fQr m ^ ^ 
the expectations are over the coin flips of f k and the 
choice of x 6 The accuracy is "up to D" if the 

requirement holds for all k £ B. 

The timing scheme <{f k ) fil > is considered "(J- 



unbeatable" if, for every Jc and every cheater o, 

The function f f tI is «i n cr era ental " if there exists an 
h-function C such that (l) # {C ) = 1; and (2) f ^ U) = 
CU,*<x>> for all k (l^, the distributions on both 
sides are identical) . 

The timing scheme < { f k]l]i> is considered a « y _ timi 
scheme" (up to B) if it is incremental and c-accurate (up 
to B) and p-uncheatable, where y = a p. 

The function |f k , is " COrnpact „ if the size Qf ^ 
does not increase as k increases. 

2D Simple Jjin_Cong truct ions 

Let h have outputs in [ 1 . . . W] for large Then g 

"simple ra in construction" for (f,, has the following 



20 
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general form: f, U) = (j , h{L(Xfj))) where h{L{ ,. fj) = 

■in[AUU,l)) l h|LU f 2„ MH-UI)], and where L(x,i) 

= L <*''j'l if ^ only if U ,ij . 0ne example 

is L(x,i) - (xJi , Another is L(x,i) = fx/rjj} for 

random r,. When L is probabilistic, the construction 
should also return r 3 . Let H/MJ be the harmonic function 
HfW =I\^ 2/i^n W+I . one possible estimation function 
for these constructions is p(y) = N/ y H{N). 

Let be our min construction, and let u(y) = 
N/ y H(N). Then <{f k ),p> is a compact (l^-(ln(N)) 
timing scheme up to N l . 

Many variations of this scheme are possible. For 
example, the inputs corresponding to the c smallest hash 
outputs could be returned, for some c > 1. m addition, 
a new instance of the computation could be started 
whenever k reached a certain threshold (e.g., < tf, , 

and the results from all instances could be returned. 
Other alternatives arise from various chained 
constructions, which allow tradeoffs of timing accuracy 
for cost of auditing. Alternatives for the estimation 
runction u also yield timing schemes with different error 
properties . 



Hardware Components 

It can be appreciated by one skilled in the art that 
any software programs, schemes, steps or algorithms 
described herein with reference to an embodiment of the 
invention can be implemented in either hardware or 
software. If implemented in software, these software 
Programs, schemes, steps or algorithms can be implemented 
on any general purpose computer, such as a personal 



SUBSTITUTE SHEET (RULE 26) 



WO 98/26571 



PCT/US97/22444 



,1 



computer, or special purpose computer, such as a digita 
signal processor (DSP), having at a minimum a processor 
with sufficient processing speed, and a computer readable 
medium such as read-only memory (ROM) , programmable ROM 
(PROM), erasable programmable ROM (EPROM), random access 
memory ( RAM ) , hard d ri ve, optical drive, floppy disk , and 



forth. 

Conclusion 



Although a preferred embodiment is specifically 
illustrated and described herein, it will be appreciated 
that modifications and variations of the present 
invention are covered by the above teachings and within 
the purview of the appended claims without departing from 
the spirit and intended scope of the invention. For 
example, although one timing scheme F with details for 
one family of constructions was provided, it can be 
appreciate that any timing scheme F fulfilling the 
parameters set forth herein falls within the scope of the 
invention. Another example is that the program attached 
to information sent by server 24 to client 20 can be 
written in any portable language besides JAVA . 
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What is claimed is : 

1. A metering apppartus for metering a visit to a web 
site, comprising: 

5 a proxy module that intercepts information between a 

client and a server; and 

a metering module that measures the duration of a 
visit, said proxy module appending said metering module 
to said information, with said metering module returning 
10 an auditable result at the end of said visit. 

2- The metering apparatus defined in claim 1, wherein 
S5ld meteri ^ ««>dula uses a timing scheme which requires 
an investment of computation power that can be estimated 
15 to within some known accuracy to measure the duration of 
said visit. 



3- The metering apparatus defined in claim 2, wherein 
said timing scheme uses a unique seed assigned to said 
20 visit. 



4. The metering apparatus defined in claim 2, wherein 
said timing scheme is compact. 

25 5. The metering apparatus defined in claim 2, wherein 
said timing scheme is accurate. 

6. The metering apparatus defined in claim 2, wherein 
said timing scheme is uncheatable. 



30 



7. The metering apparatus defined in claim 2, wherein 
said timing scheme is incremental. 
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3. The metering apparatus defined in claim 2, wherein 
said visit is initiated by a start visit event, and ends 
in response to an end visit event. 

5 

9. The metering apparatus defined in claim 8, wherein 
the length of said visit is defined as the length of time 
between said start visit event and said end visit event. 

10 10. The metering apparatus defined in claim 1, further 
comprising a log keeper module for storing said result. 

11. The metering apparatus defined in claim 1, further 
comprising an auditing module for auditing said result to 

15 ensure said result matches a known result for said 
computation . 

12. The metering apparatus defined in claim 1, wherein 
said metering module is a JAVA applet. 

20 

13. An apparatus for metering an elapsed time a client 
visits a server, comprising: 

means for activating a meter in response to a start 
visit event initiated by the client; 
25 means for deploying a program which attaches to 

information sent from the server to the client; 

means for executing said program which computes a 
function F using a unique seed provided by said meter for 
each visit, said program producing an auditable result at 
30 the end of said visit; 

means for deactivating said program in reponse to an 
end visit event initiated by the client, and returning 
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said auditable result to said meter; and 

auditing means for verifing said result matches said 
computation . 

5 14. A method for metering a visit to a web site, 

comprising : 

intercepting information between a client and a 
server; and 

appending a metering module to said information that 
10 returns an auditable result to a webmeter at the end of 
said visit for measuring the duration of said visit. 

15. The method defined in claim 14, wherein said 
metering module uses a timing scheme which requires an 

15 investment of computation power that can be estimated to 
within some known accuracy to measure the duration of 
said visit. 

16. The method defined in claim 15, wherein said timing 
20 scheme uses a unique seed assigned to said visit. 

17. The method defined in claim 15, wherein said timing 
scheme is compact. 

25 18. The method defined in claim 15, wherein said timing 
scheme is accurate. 

19. The method defined in claim 15, wherein said timing 
scheme is uncheatable. 

30 

20. The method defined in claim 15, wherein said timing 
scheme is incremental. 
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21. The method defined in claim 15, wherein said visit 
is initiated by a start visit event, and ends in response 
to an end visit event. 

22. The method defined in claim 21, wherein the length 
of said visit is defined as the length of time between 
said start visit event and said end visit event. 

23. The method defined in claim 14, further comprising 
the step of storing said result. 

24. The method defined in claim 14, further comprising 
the step of auditing said result to ensure said result 
matches a known result for said computation. 

25. A method far metering an elapsed time a client 
visits a server, comprising: 

activating a webmeter in response to a start visit 

event initiated by the client; 

deploying a metering program which attaches to 

information sent from the server to the client ; 

executing said metering program which computes a 

timing function using a unique seed provided by said 

webmeter for each visit, said program producing an 

aaditable result at the end of said visits- 
deactivating said program in reponse to an end visit 

event initiated by the client, and returning said 

auditable result to said webmeter; and 

verifying said result matches said computation. 

26. A metering apppartus for metering a visit to a web 
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site, comprising: 

proxy means for intercepting information between a 
client and a server; and 

metering means for measuring the duration of said 
visit, said proxy means appending said metering means to 
said information, with said metering means returning an 
auditable result at the end of said visit. 

27. The metering apparatus defined in claim 26, wherein 
said metering means uses a timing scheme which requires 
an investment of computation power that can be estimated 
to within some known accuracy to measure the duration of 
said visit. 



28. A computer program embodied on computer-readable 
medium for metering a visit to a web site, comprising: 

a proxy source code segment for intercepting 
information between a client and a server; and 

a metering source code segment for measuring the 
duration of said visit, said proxy segment appending said 
metering segment to said information, with said metering 
segment returning an auditable result at the end of said 



25 29. The computer program defined in claim 28, wherein 

said metering segment uses a timing scheme which requires 
an investment of computation power that can be estimated 
to within some known accuracy to measure the duration of 
said visit. 

30 

30. A computer program product for controlling a 
computer, the program product comprising: 
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a recording medium readable by the computer; 

means recorded on the recording medium for directing 
the computer to meter a visit to a web site; 

means for intercepting information between a client 
and a server; and 

means for measuring the duration of said visit, said 
means for intercepting appending said means for measuring 
to said information, with said means for measuring 
returning an auditable result at the end of said visit. 

31. The computer program defined in claim 30, wherein 
said means for measuring uses a timing scheme which 
requires an investment of computation power that can be 
estimated to within some known accuracy to measure the 
duration of said visit. 
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